System for performing remote operation between firewall-equipped networks or devices

ABSTRACT

A remote operation system is disclosed which is used with a network environment in which a unit that provides remote operation services through networks and a unit that receives the services are each safeguarded by a firewall (or “each equipped with a firewall for”) from an external network. The remote operation service receiving unit sets up a connection A with the firewall installed on the remote operation service providing unit side and transmits security check information to that firewall. The firewall checks this security check information and then sets up a connection B with the remote operation service providing unit via its associated internal network when it is determined that the security check information has been sent from a contract user unit. Thereby, information used for remote operation can be transmitted between the two units over a logical path composed of the connections A and B.

This application is a division of Ser. No. 08/614,060 filed Mar. 12,1996, U.S. Pat. No. 5,960,177.

BACKGROUND OF THE INVENTION

1. Field of the Invention

This invention relates to a remote maintenance and remote operationsystem in which a servicing device connected to an intracompany networkof a service providing company performs maintenance and management on adevice connected to a user-side network over an open external network,such as the Internet, through remote operation, and more specifically toa remote maintenance and remote operation system for use with networksystems each of which is equipped with a firewall for the other.

2. Description of the Related Art

Nowadays a system is being practiced actively which performs maintenanceand management on users' devices through remote operation over networksin order to save expenses and time for business trips.

Also, an attempt is being made to adopt a system which employs theInternet as a network for remote operation. The Internet is theworldwide network which permits free communications with unspecifiedpersons around the world. Thus, the employment of the Internet willpermit global remote maintenance service.

Incidentally, the Internet has a problem of security because it is anopen network. In particular, if an intracompany network of a company isconnected to the Internet and so all of host computers connected to thatnetwork are made accessible by outsiders over the Internet, then thecompany will be exposed to dangers that important internal informationwhich must be kept confidential may be stolen, the system may becrashed, data may be altered, and the like.

For this reason, a “firewall” has come to be provided between theInternet and an intracompany network recently. The firewall is afacility for protecting the intracompany network from hackers. Ingeneral, firewalls are roughly classified into packet filteringgateways, circuit gateways, and application gateways.

FIG. 1 is a schematic illustration of a firewall that is equipped withthe above-described packet filtering gateway feature and installedbetween an external network (Internet) 1 and an internal network(intracompany network) 2. In this figure there are illustrated IPaddress filtering and TCP port filtering by way of example.

Communications are made over the Internet on the basis on the TCP/IPprotocol and IP datagram (IP packet) routing within the Internet iscontrolled on a bucket brigade basis. The IP datagram contains an IPheader and a TCP header in its header.

The IP header contains an IP destination address (receiving IP addressin the figure) and an IP source address (transmitting IP address in thefigure). The IP address comprises a network address and a host address.

The-TCP header contains a receiving port number and a transmitting portnumber. The port numbers have a one-to-one correspondence with processesand are utilized for interprocess communications over the Internet. Afirewall 3 is provided with an IP address table 32 and a port numbertable 34. Into the IP address table 32 is entered a set of IP addressesthat is acceptable to the internal network 2. Also, into the port numbertable 34 is entered a set of port numbers that is acceptable to theinternal network 2.

In the IP address filtering, when a packet is received, a reference ismade to the IP address table 32. If a transmitting IP address that hasnot been entered into that table is placed in the IP header of thatpacket (IP datagram), the IP datagram is rejected. Also, in the TCP portfiltering, a reference is made to the port number table 34 when an IPdatagram (packet) is received. If a port number that has not been storedinto the port number table 34 is placed in the TCP header of that IPdatagram, it is rejected. In this way, specific applications, such asTelenet, FTP and the like, can be filtered.

FIG. 2 is a diagram for use in explanation of a second feature of thefirewall 3.

The firewall 3 is provided with a feature of making access to hostswithin the internal network 2 for hosts on the external network 1 (e.g.,the Internet) in order not to allow the external hosts to make directaccess to the hosts within the internal network 2. In other words,access by hosts within the internal network 2 to the external network isto be made through the firewall 3 all the time.

In the example shown in FIG. 2, an IP address of “E” is set up on thefirewall 3. Also, “A”, “B”, “C” and “D” are set up on hosts A, B, C andD in the internal network 2 as their respective IP addresses. In such asystem, for example, when the host B wants to transmit an IP datagram 12to some host (external host) on the external network 1, the host Btransmits the datagram 12 to the firewall 3 not to the external hostdirectly. Since the IP address set up on the host B is “B” as describedabove, the transmitting IP address of the IP datagram 12 is “B”. Uponreceipt of the IP datagram 12, the firewall 3 translates the originaltransmitting IP address B to its IP address “E” for subsequenttransmission over the external network.

Thus, if only the IP address of the firewall 3 is made open to theexternal network 1, the existence of the internal network will be keptfrom the external network. The feature is also called the IP relayfeature.

By installing the firewall 3 equipped with such a packet filteringgateway feature as described above between the internal network 2 andthe external network 1, improper IP datagrams that are going to enterthe internal network 2 directly from the external network 1 can beblocked almost completely.

FIG. 3 shows a system in which internal networks 2A, 2B, 2C and 2D ofrespective A, B, C and D companies are connected with a commercialnetwork 5. In this system, each of the A, B, C and D companies installsa respective one of firewalls 3A, 3B, 3C and 3D between its own internalnetwork 2A, 2B, 2C, and 2D and the commercial internet 5 in order toprotect their respective internal networks from unauthorized access viathe commercial network 5.

Next, problems with such a system as shown in FIG. 3 will be describedwith reference to FIG. 4.

In FIG. 4, the A company is a company which provides maintenance andmanagement services for pieces of software and hardware within a networkthat its client manages. Suppose that the client is the D company andthe A company considers performing. maintenance and management servicesfor a serviced device 7 connected to the D company's network 2D using aservicing device 6 connected to its own network by means of remoteoperation over the commercial internet 5.

In this case, when the IP address of the A company's firewall 3A has notbeen entered into the IP address table 32 in the D company's firewall3D, even if the servicing device 6 transmits a packet for remoteoperation to the serviced device 7 of the D company, that packet isrejected by the firewall 3D and cannot enter the D company's internalnetwork 2D. Thus, the A company cannot provides maintenance andmanagement services for the serviced device of the D company.

If, on the other hand, the IP address of the A company's firewall 3A isentered into the IP address table 32 of the b company's firewall 3D,then the A company's servicing device 6 will be able to performmaintenance and management on the D company's serviced device 7 byremote operation. However, this will result in a problem of security.That is, in this case, since any host connected to the A company'sinternal network 2A, even it be a host other than the servicing device6, can enter the D company's internal network, the possibility existsthat the internal network 2D system of the D company may be destroyedand important information may be stolen. The reason is that the Dcompany's firewall 3D cannot identify the source of packets sent fromthe A company's firewall 3A over the commercial internet 5.

In the prior art, therefore, as shown schematically in FIG. 5, directpoint-to-point connection is made by a public line 8 or private linebetween the A company's servicing device 6 and the D company's serviceddevice 7 for maintenance and management service for the latter. Withsuch an approach, however, it is required that both the A and Dcompanies prepare communications devices 9A and 9B dedicated to thedirect point-to-point connection therebetween and a servicingenvironment. Undesirably this involves double investment by both thecompanies, resulting in an increase in cost. In addition, in order toprotect intracompany network security, it is necessary to carry outtroublesome work of disconnecting each of the servicing device 6 and theserviced device 7 from its associated intracompany network 2A, 2B at thestart of service and connecting them again at the termination ofservice.

SUMMARY OF THE INVENTION

It is an object of the invention to enable remote operation betweendevices each of which is connected to its associated internal networkequipped with a firewall.

The present invention is directed to a system which is provided with aservicing unit connected to a first internal network in which a firstfirewall is installed for an external network and a serviced unitconnected to a second internal network in which a second firewall isinstalled for the external network and wherein the servicing unitperforms a remote operation on the serviced unit through the externalnetwork. In such a system, the serviced unit comprises: packetcommunications means for transmitting an identifier specifying theaddress of the servicing unit connected to the first internal network,setting up a connection with the servicing unit via the second firewalland the first firewall, and transmitting packets to or from theservicing unit over the connection; and remote operation execution meansfor fetching remote operation directive information from packetsreceived by the packet communications means and performing a remoteoperation on the serviced unit as indicated by the remote operationdirective information.

The serviced unit becomes able to transmit and receive packets used forremote operation to or from the servicing unit by first sending theidentifier to the firewall on the servicing unit side and then settingup the connection with the servicing unit. Thus, the serviced unit canreceive packets containing remote operation directive information fromthe servicing unit and perform an operation on itself as indicated bythat directive information, thereby performing a remote operation.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a diagram for use in explanation of the packet filteringgateway feature of a firewall;

FIG. 2 is a diagram for use in explanation of the IP addresstranslation/relay feature which is a second feature of the firewall;

FIG. 3 shows a system in which each of internal networks of A, B, C andD companies is connected by a firewall to a commercial internet;

FIG. 4 is a diagram for use in explanation of the reason why, in thesystem of FIG. 3, a servicing unit connected to the internal network ofthe A company cannot perform remote maintenance/operation on a servicedunit connected to the internal network of the D company;

FIG. 5 is a diagram for use in explanation of a prior art method bywhich, in the system of FIG. 3, the servicing unit connected to theinternal network of the A company performs remote maintenance/operationon a serviced unit connected to the internal network of the D company;

FIG. 6 is a first diagram for use in explanation of the principles ofthe present invention;

FIG. 7 is a second diagram for use in explanation of the principles ofthe present invention;

FIG. 8 is a third diagram for use in explanation of the principles ofthe present invention;

FIG. 9 is a fourth diagram for use in explanation of the principles ofthe present invention;

FIG. 10 shows the entire configuration of a remote maintenance andoperation system according to an embodiment of the present invention;

FIGS. 11A and 11B is a diagram for use in explanation of the overalloperation of the system of FIG. 10;

FIG. 12 shows an exemplary system configuration of the embodiment ofFIG. 10;

FIG. 13 shows a configuration of the header of an IP datagram in apacket communicated between the service company network and the clientcompany network in the system of FIG. 12;

FIG. 14 is a first diagram illustrating the contents of a packetcommunicated between the servicing unit and the client's serviced devicewhen the servicing device performs remote maintenance/operation on theserviced unit in the system of FIG. 12;

FIGS. 15A and 15B is a second diagram illustrating the contents of apacket communicated between the servicing unit and the client's serviceddevice when the servicing unit performs remote maintenance/operation onthe serviced unit in the system of FIG. 12;

FIGS. 16A and 16B is a third diagram illustrating the contents of apacket communicated between the servicing unit and the client's serviceddevice when the servicing unit performs remote maintenance/operation onthe serviced unit in the system of FIG. 12;

FIG. 17 shows the format of a packet transferred between the servicingunit and the serviced unit during the operation shown in FIGS. 14, 15and 16;

FIGS. 18A and 18B are diagrams for use in explanation of the formats ofthe respective packets shown in FIGS. 14 and 16;

FIGS. 19A and 19B is an operating flowchart illustrating a process ofrelaying a packet (IP datagram) between the serviced unit and theservicing unit by the remote maintenance/operation central unit; and

FIGS. 20A and 20B is an operating flowchart illustrating the IP relayfeature of the remote maintenance/operation central unit illustrated inthe operating flowchart of FIG. 19 from a different point of view.

DESCRIPTION OF THE PREFERRED EMBODIMENTS

Referring now to FIG. 6, which is a first diagram illustrating theprinciples of the present invention, a client's internal network 82 isconnected by an external network 84 with a remote operation serviceproviding company's internal network 86. Firewalls 83 and 85 arerespectively installed in the internal networks 82 and 86 for theexternal network 84. An embodiment of the present invention supposes aremote operation service system in which a remote operation service isprovided to a serviced unit 81 connected to the client internal network82 by a servicing unit 87 connected to the remote operation providingcompany's internal network 86.

The serviced unit 81 sets up a first connection with the second firewall85 associated with the remote operation service providing company'sinternal network 86 via the client network 82 and the first firewall 83associated with the network 82 and then communicates packets containingdata for remote operation with the servicing unit 87 connected to theservice company's internal network 86.

The second firewall 85 sets up a second connection with the servicingunit 87 via its associated internal network 86 after the firstconnection with the serviced unit 81 has been set up and then relayspackets to be transmitted between the serviced unit 81 and the servicingunit 87 using the first and second connections.

The servicing unit 87 transmits packets to be transmitted to or from theserviced unit 81 to or from the second firewall 85 over the secondconnection to thereby provide a remote operation service for theserviced unit 81.

It should be noted here that the above-described first and secondconnections indicate logical paths, not private lines.

The second firewall 85 is equipped with a validation section forvalidating whether or not the serviced unit 81 belongs to a user undercontract on the basis of the contents of data in packets transmittedfrom the serviced unit 81 over the first connection.

The serviced unit 81 is equipped with a validation section which, at thetime of receipt of a packet produced by the servicing unit 87 andtransferred from the second firewall 85 over the first connection,validates whether a remote operation executing command stored in thatpacket is valid or not.

The above-described external network is the Internet by way of example.

FIG. 7 is a second diagram illustrating the principles of the presentinvention.

In the figure, the serviced unit 81 is illustrated equipped with apacket communications section 51, a remote operation execution section52, an execution result return section 53, and a security check section54.

The packet communications section 51 transmits an identifier specifyingthe address of the servicing unit 87 connected to the internal network86 to the second firewall 85, sets up a connection with the servicingunit 87 via the first and second firewalls 83 and 85, and transmitspackets to or from the servicing unit 87 over that connection.

The execution result return unit 53 returns the results of execution ofremote operation by the remote operation execution section 52 to thesecond firewall 85 via the packet communications section.

The security check section 54 checks the validity of a remote operationcommand contained in a packet received by the packet communicationssection 51.

In this case, .the remote operation execution section 52 carries outremote operation on the serviced unit in accordance with the remoteoperation command after its validity has been confirmed by the securitycheck section 54.

FIG. 8 is a third diagram for use in explanation of the principles ofthe invention.

In this figure, a central unit 88 functions as the second firewall 85for the external network 84 of the internal network 86 of the companywhich provides remote operation service via the external network 84 forthe serviced unit 81 connected to the contract user's internal network82 in which the first firewall 83 is installed against the externalnetwork 84.

The central unit 88 is equipped with a first packet communicationssection 61, a security check unit 62, and a second packet communicationssection 63.

The first packet communications unit 61 sets up a first connection withthe serviced unit 81 via the first firewall 83 and the external network84 and transmits packets to or from the serviced unit 81 over the firstconnection.

The security check unit 62 checks packets received by the firstcommunications unit 61 after the first connection has been set up toensure that they have been sent from the serviced unit 81 of the userunder contract.

The second communications section 63 sets up a second connection withthe servicing unit 87 via its associated internal network 86 when thesecurity check section 62 determined that the packets had been sent fromthe serviced unit 81 of the user under contract and then transmitspackets to or from the servicing unit 87 over the second connection.

Moreover, the central unit 88 is equipped with a first database 64 intowhich validation information for the user under contract has beenentered. The security check section 62 checks received packets for thepresence of the validation information entered into the database 64,thereby determining whether they are from the user under contract.

Furthermore, the central unit 88 is equipped with a second database 65into which servicing unit identification information used to set up thesecond connection has been entered. The second packet communicationssection 63 may be configured to retrieve servicing unit identificationinformation corresponding to service identification information storedin packets received by the first packet communications section 61 fromthe second database 65 and set up the second connection using theservicing unit identification information.

FIG. 9 is a fourth diagram illustrating the principles of the invention.

As shown in this figure, the servicing unit 87 is equipped with a packetcommunications section 71 and a remote operation execution section 72.

The packet communications section 71 sets up a connection with thesecond firewall 85 and then transmits packets to or from the servicedunit 81 over that connection.

The remote operation execution section 72 produces a packet in which acommand is set up to perform a remote operation, which is specified byremote operation instructing information stored in packets received bythe packet communications section 71, on the serviced unit and transmitsit to the second firewall 85 via the packet communications section.

The remote operation execution section 72 obtains the result ofexecution of an remote operation that the serviced unit 81 placed frompackets received by the packet communications section and outputs it tothe outside.

Hereinafter, the operation of the system shown in FIGS. 6 to 9 will bedescribed.

The serviced unit 81 sets up a first connection with the second firewall85 installed for the remote operation servicing company's internalnetwork 86 via the client network 82, the first firewall 83 and theexternal network 84 and then transmits packets containing data forremote operation to or from the servicing unit 87 connected to theservicing company's internal network 86 over the-first connection.

The second firewall 85 sets up a second connection with the servicingunit 87 via its associated internal network 86 after the firstconnection has been set up and relays packets to be transmitted betweenthe serviced unit 81 and the servicing unit 87 by the use of the firstand second connections.

The servicing unit 87 performs remote operation service on the servicedunit 81 by transmitting packets that are to be transmitted to or fromthe serviced unit 81 to or from the second firewall 85 over the secondconnection.

For example, in this case, after the first connection has been set up,the second firewall 85 determines, through its validation section,whether the serviced unit 81 belongs to the user under contract or noton the basis of the contents of data placed in packets transmitted fromthe serviced unit 81 over the first connection.

Also, when receiving a packet from the servicing unit 87 through thesecond firewall 85 and the first connection, the serviced unit 81determines whether a remote operation executing command stored in thatpacket is a valid command or not through its validation section.

Thus, in a system in which first and second firewalls are respectivelyinstalled in a client internal network 82 and a remote operationservicing company's internal network 86 for an external network 84 towhich each of the internal networks is connected, a servicing unit 87 onthe servicing company internal network can perform remote operationservice on a serviced unit 81 on the client internal network through theexternal network with security for the customer and servicing companyinternal networks being kept.

The packet communications section 51 transmits an identifier whichallows the second firewall 85 to specify the address of the servicingunit 87 connected to the internal network 86, sets up a connection withthe servicing unit 87 through the first and second firewalls 83 and 85,and transmits packets to or from the servicing unit 87 over thatconnection. The remote operation execution section 52 fetches remoteoperation command information from a packet received by the packetcommunications section 51 and then performs remote operation asspecified by the remote operation command information.

Thus, in a system in which firewalls are respectively installed in aremote operation service providing company's internal network 86 and aclient internal network 82 for an external network 84 to which each ofthe internal networks is connected, a serviced unit 81on the clientnetwork can transmit packets to the service providing company's internalnetwork 86 and receive packets from a servicing unit 87 on the serviceproviding company's internal network 86.

The security check section 54 checks the remote operation instructioninformation placed in packets received by the packet communicationssection 51 for validity., The,remote operation execution section 52 thenperforms a remote operation according to the contents of the remoteoperation directive information the validity of which has been confirmedby the security check section 54. The execution result return section 53then sends the results of the remote operation executed by the remoteoperation execution section 52 to the second firewall 85 through thepacket communications section.

Therefore, the serviced unit 81 can receive remote operation servicewhile keeping its security and the servicing unit 87 can acquire theresults of a remote operation performed on the serviced unit 81 throughthe second firewall 85.

The first packet communications section 61 sets up a first connectionwith the serviced unit 81 through the first firewall 83 and the externalnetwork 84 and then transmits packets to or from the serviced unit 81over the first connection. The security check section 62 checks whetheror not the packets received by the first packet communications section61 after the first connection has been set up are packets transmittedfrom the serviced unit 81 of the user under contract. When it isdetermined by the securing check section 62 that the packets received bythe first packet communications section 61 are packets transmitted fromthe serviced unit 81 of the user under contract, then the second packetcommunications section 63 sets up a second connection with the servicingunit 87 through its associated internal network 86 and then transmitspackets to or from the servicing unit 87 over the second connection.

Therefore, packets can be transmitted to or from the serviced unit 81connected to the client internal network 82 in which the first firewall83 is installed. In addition, a security check can be performed onreceived packets to reject improper packets only packets sent from theserviced unit 81 of a user under contract can be transmitted to theservicing unit 87. Furthermore, packets can be transmitted from theservicing unit 87 to the serviced unit 81.

The packet communications section 71 sets up a connection with thesecond firewall 85 and then transmits packets to or from the servicedunit 81 over that connection. The remote operation execution section 72produces a packet in which a command is placed to perform on theserviced unit 81 a remote operation specified by remote operationrequest information stored in packets received by the packetcommunications section 71 and then transmits it to the second firewall85 through the packet communications section 71. Moreover, the remoteoperation execution section 72 fetches the result of execution of theremote operation set by the serviced unit 81 from packets received bythe packet communications section 71 and provides it to the outside.

Therefore, the servicing unit 87 on the service providing company'sinternal network 86 can transmit packets to or from the second firewall85 installed for the external network 84. This allows the servicing unit87 to transmit packets for remote operation service to or from theserviced unit 81 when the second firewall 85 sets up a connection withthe serviced unit 81 on the user internal network 82.

FIG. 10 shows the entire configuration of a remote maintenance andremote operation system according to an embodiment of the presentinvention.

In this figure, a network 110 is an intracompany network of the Acompany which provides remote maintenance and remote operation service,while a network 210 is an intracompany network of the D company which isa client or user of that service.

The A company's network 110 and the D company's client network 210 areconnected by a line 250 such as a public line, a commercial internet, orthe like. Between the network 110 and the line 250 is installed a remotemaintenance/operation central unit 120 which serves as a firewall. Also,a firewall 220 is installed between the client network 210 and the line250.

To the service company's network 110 is connected a servicing unit 130which provides remote maintenance and remote operation service. To theclient network 210 is connected a serviced unit 230 which receives theremote maintenance and remote operation service provided by theservicing unit 130.

The remote maintenance/operation central unit 120 has a function ofrelaying packets (IP datagrams) from the servicing unit 130 on theservice company's network 110 to the serviced unit 230 on the clientnetwork 210. The central unit 120 has a user validation feature toprovide security for its associated network 110. The user validationfeature is implemented by the provision of a user validation database121.

The user validation database 121 stores four pieces of informationitems, i.e., serviced unit ID, user ID, password, and service ID, foreach serviced unit 230.

The remote maintenance/operation central unit 120 is also equipped witha servicing unit database 122, which stores IP addresses of servicingunit 130 having service IDs which have been entered into the uservalidation database 121.

The remote maintenance/operation central unit 120 is further equippedwith a serviced unit connected section 124, a servicing unit connectingsection 125, and a service company network security section 126.

The serviced unit connected unit 124 sets up a connection A, which is alogical path, with the serviced unit 230 connected to the client network210 via the firewall 220 by means of the TCP protocol. In this case, asetup request for the connection A is made by the serviced unit 230 onthe client network 210. The serviced unit connected section 124 uses thepass A corresponding to the connection A to deliver packets bound forthe serviced unit 230 produced by the servicing unit 130 to the servicedunit 230 through the firewall 220 and the client network 210.

The servicing unit connecting section 125 is responsive to a request bythe serviced unit connecting section 124 to set up a connection B, whichis a logical path, between the remote maintenance/operation central unit120 and the servicing unit 130 through the service company networksecurity section 126 by means of the TCP protocol. Note that the setuprequest for the connection B is made after the connection path A hasbeen set up and the serviced unit 230 has been identified as a contractuser's unit on the basis of the service ID, user ID, serviced unit IDand password contained in the data part of a packet sent from theserviced unit over the path A.

The service company network security section 126 carries out theabove-mentioned user validation process of determining whether theserviced unit 230 is a contract user's unit by making a reference to theuser validation database 121 as requested by the serviced unit connectedsection 124 and then returns the result to the serviced unit connectingsection 124.

The servicing unit 130 is equipped with a central unit connectingsection 132 and a remote maintenance/operation execution section 134.

The central unit connecting section 132 sets up the connection B withthe servicing unit connecting section 125 in the remotemaintenance/operation central unit 120 through the associated network110 and receives a remote maintenance/operation requesting packettransmitted by the serviced unit 230 from the servicing unit connectingsection 125 over the path B corresponding to the connection B. Thisrequest is delivered to the remote maintenance/operation executionsection 134. A packet which stores a command to execute remotemaintenance/operation requested by the remote maintenance/operationexecution section 134 is sent to the servicing unit connecting section125 in the central unit 120 over the path B.

Upon receipt of a packet containing a message requesting the start ofremote maintenance/operation transmitted by the serviced unit 230 viathe servicing unit connecting section 125, the remotemaintenance/operation execution section 134 produces a packet bound forthe serviced unit 230 which contains, in its data part, a command toperform remote maintenance/operation on the serviced unit 230 and thenrequests the central unit connected section 132 to send that packet tothe servicing unit 130 in the remote maintenance/operation central unit120. This packet is sent by the central unit connected section 132 tothe servicing unit connected section 125 in the remotemaintenance/operation central unit 120 over the connection B, then sentby the serviced unit connecting section 124 to the serviced unit 230over the connection A. For example, the remote maintenance/operationexecution section 134 performs a remote operation of locating andcorrecting faults in hardware and software that the service company soldto the user (client).

The serviced unit 230 is composed of a central unit connecting section232, a remote maintenance/operation executed section 234, and a servicedunit security section 235.

The central unit connecting section 232 sets up the connection A withthe serviced unit connected section 124 in the remotemaintenance/operation central unit 120 through its associated firewall220 in making a request to the servicing unit 130 under contract forremote maintenance/operation of its associated unit 230. After that,commands for remote maintenance/operation and packets containing theresults of the remote maintenance/operation are transmitted between thecentral unit connecting section 232 and the servicing unit 130 over thesecondary path comprised of the connection A and the connection B.

The remote maintenance/operation executed section 234 receives packetstransmitted by the servicing unit 130 from the central unit connectingsection 232, fetches a command for remote maintenance/operation from thepackets, and analyzes and executes that command. The section 234 thenproduces a packet which contains the result of the execution of thatcommand, i.e., the result of the execution of the remotemaintenance/operation and requests the central unit connecting section232 to transmit that packet to the servicing unit 130. The central unitconnecting section 232 then sends that packet to the serviced unitconnected section 124 in the remote maintenance/operation central unit120 over the connection A.

When receiving a request by the remote maintenance/operation executedsection 234, the serviced unit security protection section 235 performsa security check on a packet that the remote maintenance/operationexecuted section 234 receives from the servicing unit 130. That is acheck is made as to whether the command stored in that packet is aproper command specified in the contract and the like. The result ofthat check is returned to the remote maintenance/operation executedsection 234. For example, the security check is made to protect filesthat the client does not want for the service provider to make accessto.

The serviced unit 230 is equipped with a non-reference file namedatabase 236 as a database which, allows the serviced unit securityprotection section 235 to make a security check as described above.

The names of files that the client forbids the servicing unit 130 tomake access to are entered into the non-reference file name database236. When a command placed in a packet, sent from the servicing unit 130is directed at any one of the files to be protected from unauthorizedaccess, the security protection section 235 instructs the remotemaintenance/operation execution section 134 to prohibit the execution ofthat command.

As a result, the remote maintenance/operation executed section 234 willexecute only commands which, of commands from the servicing unit 130,ensure the user security protection.

The operation of the above-described embodiment will be describedhereinafter with reference to FIG. 11.

In the embodiment, the execution of remote maintenance/operation isstarted as requested by the client. For example, this request is madethrough a GUI (Graphical User Interface) displayed on a display sectionof the serviced unit 230 (S11).

When this request is made, the central unit connecting section 232 setsup the connection A with the serviced unit connected section 124 in theremote maintenance/operation central unit 120 through the client network210 and the firewall 220. Thereby, a session is established between thecentral unit connecting section 232 and the serviced unit connectedsection 124, permitting packets to be transmitted between the sections232 and 124 over the connection A.

After that, the central unit connecting section 232 produces a packetcontaining the service ID, user ID, serviced unit ID and password whichwere assigned to the serviced unit 230 at the time of contract and thensends it to the serviced unit connected section 124 in the remotemaintenance/operation central unit 120 over the connection A (S12).

Upon receipt of the packet, the serviced unit connected section 124sends the service ID, user ID, serviced unit ID, and password placed inthe packet to the service company network security protection section126 for a request for determination of whether the packet was sent fromthe serviced unit connected section 124 of a contract user. The securityprotection section 125 checks the four pieces of information withinformation entered into the user validation database 121 (S13) anddetermines whether or not that packet was sent from the contract user(S14). If the determination is that the packet was sent from thecontract user (S14, YES), then the security protection section 125searches the servicing unit database 122 for a servicing unit 130corresponding to the service ID using the service ID as a key andacquires the IP address of the servicing unit 130. The securityprotection section returns the result of the check and the. IP addressof the servicing unit. 130 to the serviced unit connected section 124(S15).

If, on the other hand, the determination in step S14 is that the packetis not from a contract user (NO), then the packet is rejected. Inaddition, the connection A is disconnected.

When the serviced unit connecting section 124 receives the result of thedetermination from the associated network security protection section126 and hence knows that the packet received by itself was sent from theserviced unit 230 of a contract user, it sends the IP address of theservicing unit 130 connected to the service company network securityprotection section 126 to the servicing unit connecting section 125 tomake a request for setting up the connection B with the servicing unit130. In response to this request, the servicing unit connecting section125 sets up the connection B with the central unit connected section 132in the servicing unit 130 via the service company network 110 (S16).

Thereby, a session is established between the servicing unit connectingsection 125 and the central unit connected section 132, permitting thesections 125 and 132 to transmit packets therebetween. The servicecompany network security protection section 126 may directly request theservicing unit connecting section 125 to set up the connection B.

The servicing unit connecting section 125 notifies the central unitconnected section 132 in the servicing unit 130 via the connection Bthat packet communications with the serviced unit 230 was made possible(S17).

The central unit connecting section 232 then requests the remotemaintenance/operation execution section 134 to start the execution ofremote maintenance/operation on the serviced unit 230. In response tothis request, the execution section 134 starts providing remotemaintenance/operation services specified at the time of a contract. Theremote operation is performed by transmitting a packet containing acommand for remote maintenance/operation to the contract serviced unit230. That is, the remote maintenance/operation execution section 134produces that packet and requests the central unit connected section 132to transmit it to the serviced unit 230 (S18).

The central unit connected section 132 then transmits that packet forremote maintenance/operation execution to the servicing unit connectingsection 125 in the remote maintenance/operation central unit 120 overthe connection B (S19).

Upon receipt of that packet, the servicing unit connecting section 125sends it to the central unit connecting section 232 in the serviced unit230 over the connection A (S20).

Upon receipt of that packet, the central unit connecting section 232requests the serviced unit security protection section 235 to check itfor validity. Upon receipt of the result that the command contained inthat packet is valid from the security protection section 235, thecentral unit connecting section 232 requests the remotemaintenance/operation executed section 234 to execute that command.Then, the section 234 executes the command, produces a packet whichcontains the result of the execution, and requests the central unitconnecting section 232 to send that packet to the servicing unit 130.The connecting section 232 sends the packet received to the servicedunit connected section 124 in the remote maintenance/operation centralunit 120 over the connection A (S21).

If, in this case, it is determined by the serviced unit securityprotection section 235 that the command specified by the servicing unit130 is a command to make access to a file entered into the non-referencefile name database 236, then the remote maintenance/operation executionsection 234 will not execute that command (S22).

The serviced unit connected section 124 receives a packet containing theresults of the remote maintenance/operation execution and then sends itto the central unit connected section 132 in the servicing unit 130 overthe connection B (S23).

Upon receipt of that packet, the connected section 132 fetches theresults of the remote maintenance/operation execution from it and thensends them to the remote maintenance/operation execution section 134,which displays the execution results on the display section of theservicing unit 130 (S24).

The processes in steps 18 through 24 are repeated while the execution ofremote maintenance/operation is directed in the serviced unit 230. Notethat the remote maintenance/operation execution is directed through aGUI (Graphical User Interface) displayed on the display section of theservicing unit 130.

When the execution of all remote maintenance/operation services for theserviced unit 230 terminates, it is notified to the central unitconnected section 132 by the remote maintenance/operation executionsection 134 (S25).

The central unit connected section 132 then disconnects the connection B(S26).

After the connection B has been disconnected, the servicing unitconnecting section 125 in the remote maintenance/operation central unit120 produces a packet to assign a new password to the serviced unit 230and then sends it to the central unit connecting section 232 in theserviced unit 230 over the connection A. When the serviced unit 230acknowledges receipt of the new password, the serviced unit connectedsection 124 in the remote maintenance/operation central unit 120disconnects the connection A (S27).

After the disconnection of the connection A, the serviced unit 230stores that new password in a predetermined memory for use with the nextremote maintenance/operation (S28).

Next, the flow of packets at the time of remote maintenance/operationexecution will be described in detail.

Suppose here that, as shown in FIG. 12, the service company network 110and the client network 210 are connected by the Internet 250, and theremote maintenance/operation central unit 120 and the servicing unit 130in the service company network 110 and the firewall 220 and the servicedunit 230 in the client network 210 are assigned IP addresses and portnumbers as shown.

That is, in the service company network 110, the remotemaintenance/operation central unit 120 has its IP address set to “C”,the serviced unit connected section 124 in the central unit has its portnumber set to “P1”, and the servicing unit 130 has its IP address set to“D”.

In the client network 210, on the other hand, the serviced unit 230 hasits IP address set to “A”, the central unit connecting section 232 inthe serviced unit has its port number set to “P2”, and the firewall 220has its IP address set to “B”.

FIG. 13 shows the configuration of a header 300 set up on an IP datagramin a packet transmitted between the service company network 110 and theclient network 210.

The header 300 is composed of an IP header 301, a TCP header 302, and aremote maintenance/operation header 303. The IP header 301 containsvarious pieces of information determined by the IP protocol, such as atransmitting IP address (source address), a receiving IP address(destination address), etc. The TCP header 302 contains various piecesof information determined by the TCP protocol, such as a transmittingport number (source port number), a receiving port number (destinationport number), an SEQ (sequence number), etc.

The remote maintenance/operation header 303, which constitutes a featureof the present embodiment, contains a service ID (SVID), user ID (UID),password (PWD), and serviced unit ID (WID) which, as describedpreviously, are used for security check to determine whether or notpackets received by the serviced unit connected section 124 over theconnection A have been sent from a contract user. The remotemaintenance/operation header 303 is placed in the data part of the TCPheader 302.

FIGS. 14, 15 and 16 are diagrams for use in explanation of the flow ofpackets described in conjunction with the flowchart of FIG. 11 and thepacket contents.

Before describing the flow of packets and the packet contents, referencewill first be made to FIG. 17 to describe the format of a packet 400transmitted between the serviced unit 230 and the servicing unit 130.This packet begins with a TCP/IP header 400 a as in a usual IP datagram,followed by a remote maintenance/operation header 400 b used for remotemaintenance/operation between the serviced unit 230 and the servicingunit 130 and communications data 400 c. The TCP/IP header 400 a consistsof the IP header 301 and the TCP header 302 shown in FIG. 13. Thecontents of the remote maintenance/operation header 400 b are the sameas those of the header 303 of FIG. 13.

Of packets 401 to 406 shown in FIGS. 14, 15 and 16, packets 401, 402 and403 sent from the serviced unit 230 to the servicing unit 130 each havea TCP/IP header formatted as shown in FIG. 18A. Packets 404, 405 and 406sent from the servicing unit 130 to the serviced unit 230 each have aTCP/IP header formatted as shown in FIG. 18B.

With packet (IP datagram) communications between the serviced unit 230and the servicing unit 130 shown in FIGS. 14, 15 and 16, the connection(session) A set up between the serviced unit 230 and the remotemaintenance/operation central unit 120 and the connection (session) Bset up between the remote maintenance/operation central unit 120 and theservicing unit 130 are employed.

After the connection A has been set up, the central unit connectingsection 232 in the serviced unit 230 associated with the client network210 transmits to the firewall 220 a packet (IP datagram) 401 containinga remote maintenance/operation header in the data part of the TCP headershown in FIG. 18. The firewall 220 receives that packet over the clientnetwork 210 and then changes the transmitting IP address in the IPheader from the IP address, “A”, of the serviced unit 230 to its IPaddress “B”. The resulting packet (IP datagram) 404 is then transmittedto the serviced unit connected section 124 in the remotemaintenance/operation central unit 120 associated with the servicecompany network 110 over line 250.

The above packet communications are made by using the connection(session) A. In this case, the service company network 110 will not knowthe IP address A of the serviced unit 230 because the transmitting IPaddress of the packet 402 that the remote maintenance/operation centralunit 120 associated with the service company network 110 receives is setto the IP address B of the firewall 220 associated with the clientnetwork 210.

Upon receipt of the packet 402, the remote maintenance/operation centralunit 120 examines the remote maintenance/operation header of the packet402 while maintaining the session A with the firewall 220 on the clientnetwork 210 side. That is, the service company network securityprotection section 126 examines whether or not the service ID, user ID,password, and serviced unit ID which are placed in the remotemaintenance/operation header have been entered into the user validationdatabase 121. If the entry is confirmed, then the IP address (“D” inthis case) of the servicing unit 130 having that service ID is fetchedfrom the servicing unit database 122. The servicing unit connectingsection 125 receives this IP address D from the security protectionsection 126 and then sets up the connection (session) B with the centralunit connected section 132 in the servicing unit 130.

After that, the central unit connected section 132 produces a packet (IPdatagram) 403 shown in FIG. 15. That is, the receiving IP address in thepacket 403 is set to “D” and the transmitting IP address is set to itsIP address “C”. The receiving port number in the packet 403 is set to aport number (P3 in this case) assigned to the central unit connectedsection 132 in the servicing unit 130. Notification information from theuser for a session request is placed in the data part of the TCP header.The servicing unit connecting section 125 then sends the packet 403 tothe central unit connected section 132 in the servicing unit 130 via theassociated network 110.

In the servicing unit 130, when the central unit connected section 132receives the packet 403, the remote maintenance/operation executionsection 134 interprets directive data from the user (service provider)placed in the data part of the packet 403.

The execution section 134 then produces a command (directive informationto the service provider) to execute the maintenance/operation indicatedby the directive data and a packet (IP datagram) 404 in which thatcommand is placed in the data part. In this case, the receiving IPaddress of the packet 404 is set to the IP address “C” of the remotemaintenance/operation central unit 120 and the transmitting IP addressis set to the IP address “C” of the servicing unit 130. Further, thereceiving port number is set to the port number P1 of the servicing unitconnecting section 125 in the central unit 120 and the transmitting portnumber is set to the port number P3 of the central unit connectedsection 132. The central unit connected section 132 sends the packet 404to the servicing unit connecting section 125 in the central unit 120over the connection B.

Upon receipt of the packet 404 from the servicing unit connectingsection 125, the serviced unit connected section 124 in the central unit120 produces a packet (IP datagram) 405 shown in FIG. 15. The servicingunit connecting section 125 converts the receiving IP address,transmitting IP address., and receiving port number in the packet 404.That is, the receiving IP address in the packet 405 is set to the IPaddress B of the firewall 220 associated with the client network 210 andthe transmitting IP address is set to the IP address C of the centralunit 120.

Further, the receiving port number is set to the port number P2 of thecentral unit connecting section 232 in the serviced unit 230 on theclient network 210. The serviced unit connecting section 124 transmitsthe packet 405 to the firewall 220 on the client network 210 over theconnection A. Upon receipt of the packet 405, the firewall 220 firstperforms an IP address translation process and then produces a packet(IP datagram) 406 shown in FIG. 16. That is, the receiving IP address istranslated from B to A, the IP address of the serviced unit 230, and thetransmitting IP address is translated from C to B, the IP address of thefirewall itself. The firewall 220 transmits the packet 406 to thecentral unit connecting section 232 in the serviced unit 230 using thesession with the serviced unit 230.

In this way, the serviced unit 230 receives only packets in which thetransmitting IP address is the IP address of the firewall. Therefore,the serviced unit will not know the IP address of the servicing unit130.

The central unit connecting section 232 receives the packet 406 and thensends it to the remote maintenance/operation executed section 234. Theexecuted section 234 fetches directive information of the serviceprovider from the packet 406, analyzes it, and carries outmaintenance/operation indicated by it. The directive information ischecked for validity by the serviced unit security protection section235 before the maintenance/operation is carried out. The remotemaintenance/operation execution section 234 carries out only directiveinformation that has been validated.

After the termination of the execution of the remotemaintenance/operation, the remote maintenance/operation executionsection 234 produces a packet (IP datagram) which contains the result ofthe execution in the data part of the TCP header. This packet is sent tothe servicing unit 130 connected to the service company network 110 overthe secondary path (refer to FIG. 10) connected by the connection A andthe connection B described previously.

Next, the operation of the remote maintenance/operation central unit 120to set up the connection (session) A with the serviced unit 230connected to the client network 210 via the fire wall 220 installed inthe client network 210 will be described in more detail.

FIG. 19 is an operating flowchart illustrating the process of relayingpackets (IP datagrams) between the serviced unit 230 and the servicingunit 130 by the remote maintenance/operation central unit 120.

Note here that the firewall 220 on the client network 210 is equippedwith, for example, the TCP port filtering feature. When a contract forremote maintenance/operation service is concluded, the service providingcompany informs the contract user of the port number assigned to theserviced unit connected section 124 in the remote maintenance/operationcentral unit 120. Then, a firewall 220 administrator of the servicereceiving company sets the TCP port filtering of the firewall 220 sothat packets can be transmitted between the serviced unit 230 on theservice receiving company network 210 and the serviced unit connectedsection 124 through that firewall 220. The port number of the servicedunit connected section 124 may be fixed or may vary with the servicedunits.

When the firewall 220 on the client network is equipped with the IPaddress filtering feature, the service provider informs the contractuser of the IP address of the remote maintenance/operation central unit120 and then requests the user to set the IP address filtering so thatpackets transmitted from the remote maintenance/operation central unit120 toward the serviced unit 230 can pass through the firewall 220.

The serviced unit connected section 124 is always placed in the waitstate for a request for session (connection) setup by the serviced unit230 (S41).

Upon receipt of a packet containing a session setup requesting messagefrom the serviced unit 230 via the firewall 220, the serviced unitconnected section 124 requests the service company network securityprotection section 126 to make a check as to whether or not the serviceID, user ID, password and serviced unit ID which are placed in theremote maintenance/operation header of that packet have been enteredinto the user validation database 121 (S42).

After that, the serviced unit connected section 124 receives the resultfrom the security protection section 126 to determine whether or not theserviced unit 230 belongs to a contract user (S43).

Next, if the determination is that the session setup requesting messageis not from a contract user (S43, NG), then the serviced unit connectedsection 124 rejects the request for session setup (S44).

If, on the other hand, the determination is that the session setuprequesting packet is from a contract user (S43, OK), then the servicedunit connected section 124 sends the service ID contained in that packetto the servicing unit connecting section 125. Upon receipt of thatservice ID, the servicing unit connecting section 125 retrieves the IPaddress of the servicing unit 130 corresponding to the service ID fromthe servicing unit database 122 (S45).

And, the servicing unit connecting section 125 sets up the session(connection) B with the servicing unit 130 having the IP address via theservice company network 110 using this IP address.

Then, the servicing unit connecting section 125 generates a childprocess for the serviced unit 230 while maintaining the sessions(connections) with the serviced unit 230 and the servicing unit 130(S47).

Next, the servicing unit connecting section 125 makes a system call towait for a session request by another serviced unit 230 (S48). Theprocedure then returns to step S41.

The above-described steps S41 to S48 allows the remotemaintenance/operation central unit 120 to set up multiple sessionsbetween the serviced unit 230 and the servicing unit 130. That is, theservicing unit 130 can provide remote maintenance/operation service tomultiple serviced units 230.

In FIG. 19, there are illustrated child processes generated by sessionsset up between the servicing unit 130 and a serviced unit A, between theservicing unit 130 and a serviced unit B, and between the servicing unit130 and a serviced unit C. Each child process is equipped with a buffer127 (127A, 127B, 127C) for the corresponding serviced unit 230 and abuffer 128 (128A, 128B, 128C) for the servicing unit 13. When a packetis transmitted from a serviced unit 230 to the servicing unit 130, it isstored temporarily in the corresponding buffer 127 and then copied intothe buffer 128 for the servicing unit 130. The packet stored in thebuffer 128 is taken out by the servicing unit connecting section 125,then output to the servicing unit 130.

Though not shown in FIG. 19, where a packet is sent from the servicingunit 130 to a serviced unit 230, it is temporarily stored in the buffer128 for the servicing unit 130, then copied into the correspondingbuffer 127 for the serviced unit 230. The packet is taken out from thebuffer 127 by the serviced unit connected section 124, then output tothe serviced unit 230.

In the manner described above, packets are transmitted between theserviced unit 230 and the servicing unit 130 via the remotemaintenance/operation central unit 120 by the use of the twoconnections—the connection A and the connection B—and remotemaintenance/operation is performed on the serviced unit 230 by theservicing unit 130.

FIG. 20 is an operating flowchart illustrating the IP relay feature ofthe remote 125 maintenance/operation central unit 120 from a differentpoint of view.

In this figure, based on steps S41 to S46, which are identical to thecorresponding steps in FIG. 19, the servicing unit connecting section125 sets up a session (connection B) with the servicing unit 130 throughthe service company network 110 in accordance with a session setuprequest by the serviced unit 230.

The servicing unit connecting section 125 then creates a sessionmanagement table (S51). This table contains three types of informationitems—session number, serviced unit session ID, and servicing unitsession ID. The serviced unit session ID is related to a session that isset up by the connection A established between the serviced unit 230 andthe serviced unit connected section 124. The servicing unit session IDis related to a session that is set up by the connection B establishedbetween the servicing unit connecting section 125 and the servicing unit130. By the serviced unit session ID and the servicing unit session ID,information about a logical path established between the serviced unit230 and the servicing unit 130 is obtained, which allows the remotemaintenance/operation central unit 120 to carry out a process ofrelaying packets (IP datagrams) between the serviced unit 230 and theservicing unit 130. The session ID, which is managed on the TCP protocollayer by the servicing unit connecting section 125, is used to identifyeach session (connection) distinguished by information such astransmitting IP address, receiving IP address, transmitting port number,receiving port number and the like. In the session management table,each session between the serviced unit 230 and the servicing unit 130that is determined by a set of serviced unit and servicing unit sessionIDs is assigned a unique session number.

The remote maintenance/operation central unit 120 (the serviced unitconnected section 124 or servicing unit connecting section 125) waitsfor entry of packets from each unit (the serviced unit 230 or theservicing unit 130) (S52).

Upon receipt of a packet from a unit, the remote maintenance/operationcentral unit 120 (serviced unit 124 or servicing unit connecting section125) searches the session management table by the ID (session ID) of asession over which that packet has been transmitted and fetches thesession ID of a unit (serviced unit 230 or servicing unit 130)corresponding to that session ID from the session management table(S54). That is, when the serviced unit connected section 124 receives apacket from the serviced unit 230, it fetches the servicing unit sessionID corresponding to the session (serviced unit session ID) over whichthat packet has been transmitted. On the other hand, when the servicingunit connecting section 125 receives a packet from the servicing unit130, it fetches the serviced unit session ID corresponding to thesession (servicing unit session ID) over which that packet has beentransmitted.

The servicing unit connecting section 125 sends the packet from theserviced unit 230 to the servicing unit 130 according to the session IDfetched. Also, the serviced unit connected section 124 sends the packetfrom the servicing unit 130 to the serviced unit 230 according to thesession ID fetched (S55).

According to the present embodiment, as described above, in a system inwhich an internal network of a remote maintenance/operation serviceproviding company and an internal network of a client company having aservice receiving unit are interconnected by an external network such asan internet, public line or the like and each of the companies isequipped with a firewall for the external network, the service providingcompany can use a servicing unit connected to its internal network toperform remote maintenance/operation on the serviced unit connected tothe client internal network. And moreover, both the companies areequipped with a security protection feature and hence can providesecurity for their respective internal networks.

In the present embodiment, a commercial internet can be used as theexternal network. In this case, dialup IP connection users can becomeclients. In addition, users who use dialup IP connection terminals eachassigned an IP address at the time of line connection to the commercialinternet can also become clients. The reason is that, in the presentembodiment, whether received packets have been sent from a contract useror not is determined on the basis of the service ID, user ID, servicedunit ID and password which are entered at the time a contract isconcluded and thus contract user validation can be made possible withoutdepending on only IP addresses.

Although, in the above embodiment, the TCP/IP protocol is used to,transmit packets for remote maintenance/operation, this is notrestrictive and any other protocol may be used. Moreover, theintracompany networks of a contract user company and a service providingcompany need not necessarily be interconnected by the Internet and maybe interconnected by any network that is provided by a common carrier.Furthermore, the present invention is applicable not only to remotemaintenance/operation but also to remote operation in general.

According to the present invention, a remote operation service receivingclient and a remote operation service providing company can performremote operation by the use of units connected to their respectiveintracompany networks with their respective firewalls installed in anexternal network. Therefore, existing intracompany networks can be usedas they are to implement a safe, inexpensive remote operation servicesystem.

A serviced unit is equipped with a security check feature which preventsthe execution of remote operations other than those specified in acontract, thus ensuring security. Also, a service providing company isequipped with a security check feature which, after a connection hasbeen set up with the serviced unit of a contract user, checks packetssent over the connection for the presence of user validation informationindicating a contract user, thus protecting the servicing unit fromunfair access.

What is claimed is:
 1. A remote operation service system in which firstand second internal networks are connected to an external network byfirst and second firewalls which are respectively installed in saidfirst and second networks, and a servicing unit connected to said secondinternal network provides remote operation services to a serviced unitconnected to said first internal network, said serviced unit including:means for setting up a first connection with said second firewallinstalled for said second internal network via said first internalnetwork and said first firewall installed for said first internalnetwork; and means for transmitting packets containing data for a remoteoperation to or from said servicing unit over said first connection,said second firewall including: means for, after checking whether or notthe received packets being the packets transmitted from the saidserviced unit belonging to a contract user, and after said firstconnection has been set up with said serviced unit, setting up a secondconnection with said servicing unit via said second internal network;and means for relaying packets between said serviced unit and saidservicing unit using said first and second connections, and saidservicing unit including: means for providing remote operation servicesto said serviced unit by transmitting packets to or from said servicedunit via said second firewall and said second connection.
 2. The systemaccording to claim 1, wherein said serviced unit includes validationmeans for, when receiving a packet from said second firewall, which saidpacket transmitted from said servicing unit over said first connection,checking a command for remote operation in said packet for its validity.3. A remote operation service system in which first and second internalnetworks are connected to the Internet by first and second firewallswhich are respectively installed in said first and second networks, anda servicing unit connected to said second internal network providesremote operation services to a serviced unit connected to said firstinternal network, said serviced unit including: means for setting up afirst connection with said second firewall installed for said secondinternal network via said first internal network and said first firewallinstalled for said first internal network; and means for transmittingpackets containing data for a remote operation to or from said servicingunit over said first connection, said second firewall including: meansfor, after checking whether or not the received packets being thepackets transmitted from the said serviced unit belonging to a contractuser, and after said first connection has been set up with said servicedunit, setting up a second connection with said servicing unit via saidsecond internal network; and means for relaying the received packetsbetween said serviced unit and said servicing unit using said first andsecond connections if the received packets belonged to the contractuser, and said servicing unit including: means for providing remoteoperation services to said serviced unit by transmitting packets to orfrom said serviced unit via said second firewall and said secondconnection.
 4. The system according to claim 3, wherein said servicedunit includes validation means for, when receiving a packet from saidsecond firewall, which said packet transmitted from said servicing unitover said first connection, checking a command for remote operation insaid packet for its validity.
 5. A remote operation service providingmethod in a remote operation service system in which first and secondinternal networks are connected to an external network by first andsecond firewalls which are respectively installed in said first andsecond networks and a servicing unit connected to said second internalnetwork provides remote operation services to a serviced unit connectedto said first internal network, said remote operation service providingmethod comprising the steps of: in said serviced unit, setting up afirst connection with said second firewall installed for said secondinternal network via said first internal network and said first firewallfor said first internal network; in said serviced unit, transmittingpackets containing data for performing a remote operation to or fromsaid servicing unit connected to said second internal network over saidfirst connection; in said second firewall, setting up a secondconnection with said servicing unit via said second internal network,after checking whether or not the received packets being the packetstransmitted from the said serviced unit belonging to a contract user,and after said first connection has been set up with said serviced unit;in said second firewall, relaying packets between said serviced unit andsaid servicing unit by transmitting packets to or from said servicedunit via said second firewall and said second connection.
 6. A remoteoperation method for use with a unit to be serviced which is connectedto a second internal network in which a second firewall is installed foran external network and receives a remote operation service from aservicing unit connected to a first internal network in which a firstfirewall is installed for the external network, comprising: establishingby the unit to be serviced a connection to the first firewall throughthe second firewall; transmitting by the unit to be serviced a packet toand from the first firewall through the connection; determining by thefirst firewall whether the unit to be serviced belongs to the contractuser based upon contents of the received packet, and forwarding to theservicing unit only received packets sent from a contract user;checking, by the unit to be serviced, security of remote operationdirective information stored in a received packet; performing, by theservicing unit, a remote operation on the unit to be serviced accordingto the remote operation directive information whose security is checkedby the first firewall; and transmitting, by the unit to be serviced, anexecution result of the remote operation to the first firewall throughthe connection.
 7. A security check method for use with a center devicefunctioning as a second firewall in response to access through anexternal network to a servicing unit by a unit to be serviced which isconnected to a first internal network in which a first firewall isinstalled for the external network, comprising: establishing by thecenter device a first connection to the unit to be serviced through thefirst firewall and the external network; transmitting by the centerdevice a packet to and from the unit to be serviced through the firstconnection; checking by the center device after establishing the firstconnection whether received packet is transmitted from the unit to beserviced of a subscriber; establishing by the center device a secondconnection to the servicing unit through an internal network when thecenter device determines as a result of the checking that the receivedpacket is transmitted from the unit to be serviced of the subscriber;and transmitting by the center device the packet to and from theservicing unit connected to the internal network through the secondconnection, wherein only packets transmitted from the unit to beserviced of the subscriber are transmitted to the servicing unit.